EFail – Vulnerabilities in end-to-end encryption technologies OpenPGP and S/MIME

Re:EFail – Vulnerabilities in end-to-end encryption technolo... by cyphar on Monday May 14, 2018 @08:07PM (#17070535)

Modern TLS uses AEAD in the form of ChaCha20-Poly1305 as well as AES-GCM. I believe that the current standards in AEAD for ciphers are GCM-mode, EAX-mode and OCB-mode (CCM-mode is also used but only because it has no patents while OCB does -- CCM is more complicated and doesn't have some nice properties that OCB has).

[ Parent | on HN ]

Re:EFail – Vulnerabilities in end-to-end encryption technolo... by shinigami on Monday May 14, 2018 @10:03PM (#17071069)

Yes, but that's an online protocol. The problem here is data at rest...

[ Parent | on HN ]

Re:EFail – Vulnerabilities in end-to-end encryption technolo... by cyphar on Monday May 14, 2018 @10:39PM (#17071211)

All of the cipher suites I mentioned can be used with at-rest data (including ChaCha20-Poly1305, and AES-{GCM,EAX,OCB}), which means that there's nothing stopping PGP from adding support for them.

But since you asked, the offline backup software restic[1] uses AEAD (though it's a mix of AES-256-CTR and Poly1305 rather than AES-GCM[2] -- but it's still an AEAD construction). I also recently started working on a paper-backup project, and used ChaCha20-Poly1305 over PGP because of the lack of AEAD (and also because it is vulnerable to surreptitious forwarding -- something that AEAD also solves[3]).

There are distinctions between online and offline protocols (mainly related to PFS), but whether or not AEAD-capable cipher suites can be used is not one of them.

[1]: https://restic.net/ [2]: https://blog.filippo.io/restic-cryptography/ [3]: https://www.usenix.org/legacy/publications/library/proceedin...

[ Parent | on HN ]

Re:EFail – Vulnerabilities in end-to-end encryption technolo... by shinigami on Tuesday May 15, 2018 @07:11AM (#17073098)

AEAD is not enough. How do you decrypt/verify a 100 GB file with AEAD, without disclosing unauthenticated plaintext in a single pass? You need streaming AEAD like STREAM or CHAIN.

[ Parent | on HN ]

Re:EFail – Vulnerabilities in end-to-end encryption technolo... by cyphar on Tuesday May 15, 2018 @07:43AM (#17073223)

Doesn't OCB allow you to stream and verify in a single-pass (because the MAC is embedded in the 128-bit blocks of the underlying cipher blocks)?

[ Parent | on HN ]

Re:EFail – Vulnerabilities in end-to-end encryption technolo... by shinigami on Wednesday May 16, 2018 @08:57AM (#17081982)

I'm not sure I understand. In OCB (or any other AEAD) there is a single MAC for the entire ciphertext. You can't decrypt&verify large data in a single pass.

[ Parent | on HN ]

Re:EFail – Vulnerabilities in end-to-end encryption technolo... by cyphar on Wednesday May 16, 2018 @10:43AM (#17082774)

You are completely right that for some constructions (such as ChaCha20-Poly1305, AES-CCM, and possible AES-GCM) there is only a single MAC for the entire ciphertext.

However that is not true for other constructions. AES-OCB is a single-pass cipher that has a MAC for each block (this is actually the main selling feature of OCB). (AES-EAX also has a MAC for each block too, but is two-pass.)

Also, STREAM/CHAIN are also AEAD, so your generalisation can't be always true.

[ Parent | on HN ]

Re:EFail – Vulnerabilities in end-to-end encryption technolo... by shinigami on Thursday May 17, 2018 @08:11AM (#17090620)

I don't see it. From https://www.rfc-editor.org/rfc/rfc7253.txt :

Function name: OCB-ENCRYPT Input: K, string of KEYLEN bits // Key N, string of no more than 120 bits // Nonce A, string of any length // Associated data P, string of any length // Plaintext Output: C, string of length bitlen(P) + TAGLEN bits // Ciphertext

Only a single tag, exactly like CCM and GCM. Am I missing something?

It depends on what you call "AEAD", of course. For me it's something that generates a single MAC. STREAM/CHAIN can then be used with an underlying AEAD (GCM, CCM, OCB, SIV) to create a "streaming AEAD" that generates multiple chunks, each one of them with a MAC.

[ Parent | on HN ]

Re:EFail – Vulnerabilities in end-to-end encryption technolo... by cyphar on Thursday May 17, 2018 @09:12PM (#17097825)

I'll be honest, I was going off the Wikipedia description of the algorithm.

But looking at the RFC you're right that there's only one authentication tag (I also looked at the GPG implementation as well as the proposed OpenPGP RFC for AEAD -- and it looks like they implement chunking on top of OCB/EAX/GCM for this reason). I stand corrected.

[ Parent | on HN ]